Method and apparatus of otp based on challenge/response

Abstract

The present invention is proposed to solve the problem of high cost of an ordinary OTP token and the problem of vulnerability to hacking of a mobile OTP, for which an OTP program is mounted to solve the problem of high cost. There is provided a user authentication system and a method thereof, in which a user sets an image password as a fixed key, a query terminal outputs a query screen on which a created OTP is divided into pieces and matched to images of the fixed key, the user who confirms the query screen sequentially inputs the numbers that correspond to the image password, i.e., the fixed key of the user himself or herself, and a result of user authentication is processed according to whether the inputted numbers are matched to the response value prepared in a server.

1 . A user authentication system comprising:
 a server that prepares a user's fixed key, a personal query function for creating a one-time query for confirming whether a user knows the fixed key, and a correct response value for the one-time query, wherein a response value inputted from the user is compared with the response value stored in the server, and a result of authentication is processed according to a result of the comparison; and   a query terminal mounted with a query function that is the same as the personal query function within the server.   
   
   
       2 . The system according to  claim 1 , wherein the user's fixed key is set to images, the query function is a function that matches an arbitrary number to each of the images, the response value is a number matching to the images that correspond to the fixed key, and the query terminal displays all numbers respectively matching to the images. 
   
   
       3 . The system according to  claim 1 , wherein the user's fixed key is set to images, the query function is a function that randomly shuffles the images, the response value is a set of relative coordinates among the images corresponding to the fixed key, and the query terminal displays the images that are randomly shuffled by the query terminal. 
   
   
       4 . The system according to  claim 1 , wherein the query terminal is a cellular phone mounted with a query program. 
   
   
       5 . A user authentication method comprising:
 A) a user authentication service preparation step comprising the steps of:   A-1) allowing a server to provide a fixed key setting screen so that a user can set a fixed key;   A-2) allowing the user to set a fixed key through the fixed key setting screen provided by the server;   A-3) creating a personal set including the set fixed key;   A-4) creating an OTP function for a one-time query;   A-5) creating a query program package including the personal set and the OTP function;   A-6) downloading the query program package to a handheld information device of the user; and   A-7) installing the downloaded query program package in the handheld information device of the user, and   B) a user authentication step comprising the steps of:   B-1) allowing a site that needs user authentication to call an authentication server;   B-2) allowing a user's query program in the authentication server to create a one-time query and a response value therefor referring to the user s fixed key;   B-3) allowing a user's handheld query program to create a one-time query;   B-4) allowing the user to input a response value for the one-time query;   B-5) comparing the inputted response value with the response value in the server; and   B-6) processing the authentication as a success if the inputted response value is the same as the response value in the server, whereas processing the authentication as a failure if the inputted response value is not the same as the response value in the server.